Privacy Policy
Last updated: 27 May 2026
1. Who is responsible for your data
Mercuriosity is part of Medical Industries Group B.V., registered in the Netherlands under Dutch Chamber of Commerce (KvK) number 24278021. Nancy Lamerigts is the controller for personal data processed through mercuriosity.eu. For questions about this policy or about data we hold on you, contact nancy@mercuriosity.eu.
2. What we collect
We try to collect as little as possible. There are five points where data enters our systems.
2.1 Email address (newsletter and lead magnets)
When you sign up for one of the lead magnets (Congruence Gap Scan, Early-Data Pitch Bank), or when you enter your address before starting the Founder Signal Audit or the Evidence Chain Translator, you provide your email address through a form delivered by Kit (ConvertKit); your email is stored in our Kit list and used to send you the material you signed up for and, with your consent, The Operating Table.
When you subscribe to The Operating Table directly through the signup block on our pages, that form is hosted and processed by Substack, and your email is stored in the Substack list and used to send you the newsletter. That form is not loaded until you press the button that reveals it, so nothing is sent to Substack unless you choose to use it.
2.2 Tool submissions (anonymous)
When you use the Evidence Chain Translator, the six fields you enter (device description, stage, tier, route, indication, claim) are sent anonymously to a database hosted on Supabase. The Founder Signal Audit and the Congruence Gap Scan send their scores to the same database in the same way. We do not record your email, your IP address, or any account identifier alongside them.
This holds even though the Founder Signal Audit and the Evidence Chain Translator ask for an email address before they start. The address goes to Kit; the answers go to Supabase; the two are never joined. We cannot tell you which score belongs to which subscriber, and neither can anyone else. We use these submissions to understand which device profiles and which gaps are common, and to improve the tools.
2.3 Direct contact
If you email nancy@mercuriosity.eu directly (for example, to request a Founder Clarity Call), your email address, name, and the content of your message are received and kept in the mailbox for as long as needed to handle the conversation and follow up.
2.4 Server logs (Vercel hosting)
Our hosting provider, Vercel, automatically receives basic technical information when you visit the site (IP address, user agent, request path, timestamp). This is standard for any website on the internet. Vercel uses it for security, abuse prevention, and performance. We do not use these logs to identify or profile individual visitors.
2.5 Purchases and payments (Stripe)
When you buy a product or service (for example the Founder Signal Kit or the Congruence Audit), the checkout and payment are handled by Stripe. Stripe collects your name, email address, business name, billing address, VAT number if you provide one, and your payment details. Your card or bank details never touch our own systems. We receive your name, email, business details and the transaction record, and we use them to deliver what you bought, to send your invoice, and to meet our legal bookkeeping obligations. If you tick Stripe's "save my info" option (Stripe Link), that choice stores your payment details with Stripe for your own future use, not with us.
3. Why we process it (lawful basis)
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address | Deliver newsletter and lead magnets | Consent (you opted in) |
| Tool submissions (anonymous) | Improve the tools | Legitimate interest; no personal data involved |
| Direct emails to us | Respond to your request | Legitimate interest; sometimes consent |
| Server logs | Security, hosting operations | Legitimate interest |
| Purchase and invoice data | Deliver your purchase, invoicing, bookkeeping | Contract; legal obligation (fiscal retention) |
4. Who we share it with (sub-processors)
We do not sell your data. We do not share it with advertisers. The only third parties who see your data are the providers we use to run the site:
- Substack — newsletter list and delivery. substack.com/privacy
- Kit (ConvertKit) — lead magnet opt-in forms and delivery emails. kit.com/privacy
- Stripe — payment processing, checkout, and invoicing for paid products and services. stripe.com/privacy
- Supabase — anonymous storage of submissions from the Evidence Chain Translator, the Founder Signal Audit and the Congruence Gap Scan (EU region, eu-central-1). supabase.com/privacy
- Vercel — hosting and server logs. vercel.com/legal/privacy-policy
Substack, Kit, Stripe and Vercel are headquartered in the United States and may process data there under their standard contractual clauses. Supabase data for our project is held in the EU.
5. How long we keep your data
- Email on the newsletter or lead magnet list: until you unsubscribe (one click in any email).
- Purchase and invoice data: seven years, the legal retention period for financial administration in the Netherlands.
- Direct emails to us: as long as the conversation is active, plus a reasonable archival period.
- Tool submissions: retained anonymously; no link back to you exists.
- Server logs: per Vercel's retention policy (typically short).
6. Your rights (GDPR)
If you are in the EU, EEA, or the UK, you have the right to:
- Access the personal data we hold on you
- Correct it if it is wrong
- Have it deleted (the right to be forgotten)
- Receive a copy of it in a portable format
- Object to specific processing
- Withdraw consent at any time (for newsletter signup, unsubscribe is the fastest path)
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl)
To exercise any of these rights, email nancy@mercuriosity.eu. We respond within 30 days.
7. Cookies
This site uses no analytics cookies, no advertising cookies, and no third-party tracking. The only browser storage we use is a single record of your cookie consent choice, stored in localStorage. Full details on the Cookies page.
8. Children
This site is intended for professionals in MedTech, not for children. We do not knowingly collect data from anyone under 16.
9. Changes to this policy
If we change this policy, we update the "Last updated" date at the top. For material changes that affect how we handle existing newsletter subscribers, we notify the list directly.
10. Contact
Mercuriosity, part of Medical Industries Group B.V.
KvK 24278021 · The Netherlands
Nancy Lamerigts, data controller
mercuriosity.eu · nancy@mercuriosity.eu